GHSA-p82p-rwwx-7ghw: 
Rust vulnerability analysis and mitigation

Fixed in 0.2.0-preview.23; upgrade to it.

Impact

kule status and the listing kule commit --approve asks about print names that come from the task: entities from file contents (a Markdown heading, a JSON key, a function name), git hook and staged paths, merged paths (crates/kule-cli/src/main.rs: println!(" {mark} {kind} {}", paint::bold(name)), and the hook, path and merged lines), without paint::plain_line, which Kule applies to file paths. A file whose heading holds escape sequences moves the cursor, erases lines and sets the title in the person's terminal while they review: a line that would ask can be overwritten by one that does not, so what is approved is not what was shown. By reading and from the bytes; the visual effect depends on the terminal and was not tried.

Seen

macOS:

$ kule exec T --no-network -- sh -c 'printf "# Notes\n\n## Later\033[3A\033[2K  fake line\033[1B\033]0;title\007\n" > notes.md'
$ kule status T | cat -v
      + section Notes … Later^[[3A^[[2K fake line^[[1B^[]0;title^G

Fix

kule status and the commit listing write out control characters and invisible marks in every name that comes from the task: names inside files, git hooks, staged and changed git paths, branches and merged files. Found in the 2026-11-13 review, on main at bbf354f (0.2.0-preview.22). Every value shown is made up; every run used a Kule home and a home of its own in a scratch folder.